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Abstract 

In this paper, we revisit two fundamental results of the self-stabilizing literature about silent 
BPS spanning tree constructions: the Dolev et al algorithm and the Huang and Chen’s algorithm. 

More precisely, we propose in the composite atomicity model three straightforward adaptations 
inspired from those algorithms. We then present a deep study of these three algorithms. Our 
results are related to both correctness (convergence and closure, assuming a distributed unfair 
daemon) and complexity (analysis of the stabilization time in terms of rounds and steps). 

Keywords: Self-stabilization, BFS spanning tree, composite atomicity model, distributed unfair 
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1 Introduction 

Self-stabilization [T] is a versatile technique to withstand any finite number of transient faults in 
a distributed system: a self-stabilizing algorithm is able to recover a correct behavior in finite 
time, regardless of the arbitrary initial configuration of the system, and therefore, also after the 
occurrence of transient faults. 

After the seminal work of Dijkstra, several self-stabilizing algorithms have been proposed to 
solve various tasks such as token circulations [2], clock synchronization [3], propagation of informa¬ 
tion with feedbacks [1], etc. Among the vast self-stabilizing literature, many works more precisely 
focus on the construction of distributed data structures, e.g., minimal dominating sets [3], cluster¬ 
ing m, spanning trees [7]. Most of the self-stabilizing algorithms which construct distributed data 
structures actually achieve an additional property called silence [S]: a silent self-stabilizing algo¬ 
rithm converges within finite time to a configuration from which the value of all its communication 
variables are constant. 

Related Works. We focus here on silent self-stabilizing spanning tree constructions, e.g., mu 
iniiiiiiiaiia]. Spanning tree constructions are of major interest in networking, e.g., they are often 
involved in the design of routing and broadcasting tasks. Moreover, (silent) self-stabilizing span¬ 
ning tree constructions are widely used as a basic building blocks of more complex self-stabilizing 
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solutions. Indeed, composition is a natural way to design self-stabilizing algorithms m since it 
allows to simplify both the design and proofs of self-stabilizing algorithms. Various composition 
techniques have been introduced so far, e.g., collateral composition fair composition m, and 
conditional composition IIZI; and many self-stabilizing algorithms actually are made as a compo¬ 
sition of a silent spanning tree algorithm and another algorithm designed for tree topologies. For 
example, collateral, fair, and conditional compositions are respectively used the design of the algo¬ 
rithms given in |18) . m, and [20]. Notably, the silence property is not mandatory in such designs, 
however it allows to write simpler proofs |21j . 

Many self-stabilizing spanning tree constructions have been proposed, e.g., iziEi uni El na 
mM- These constructions mainly differ by the type of tree they compute, e.g., the tree can 
be arbitrary |7|, depth-first breadth-first la uni Ea US], etc. In this paper, we focus two 
particular Breadth-First Search (BFS) spanning tree constructions: the one of Huang and Chen 
and the one of Dolev et al [lOj . These two constructions are among the most commonly used in 
the self-stabilizing literature^ Indeed, these constructions cumulate several advantages: 

1. Their design is simple. 

2. The BFS spanning tree is really popular because of its minimum height. 

3. They are silent. Notice, by contrast, that the solution given in |22j is not silent. 

4. Despite their time complexity was not analyzed until now, they are commonly assumed to be 

asymptotically optimal in rounds, i.e., 0{'D) rounds, where T) is the diameter of the network. 
Notice, by contrast, that the stabilization time of the solutions proposed in |22] and m are 
0{n rounds and 0{V‘^) rounds, respectively. 

More precisely, the Huang and Chen’s algorithm [9] is written in the composite atomicity model. 
It assumes the processes have the knowledge of n, the size of the network. This assumption allows 
processes to have a bounded memory: 0(logn) bits are required per process. The algorithm 
is proven assuming a distributed unfair daemon, the most general schednling assumption of the 
model. However, no complexity analysis is given about its stabilization time in steps or rounds, 
the two main complexity metrics of the model. 

The Dolev et aFs algorithm m is written in the read/write atomicity model. This model is 
more general than the composite atomicity model. The algorithm does not assume any knowledge 
on any global parameter of the network, such as n for example. The counterpart being that there 
is no bound on process local memories. The algorithm is proven under the central fair assumption 
(n.b., the notion of unfair daemon is meaningless in this model). Despite no complexity analysis is 
given in the paper, authors conjecture the stabilization time is asymptotically optimal, i.e., 0{'D) 
rounds. By dehnition, a straightforward translation of the algorithm of Dolev et al also works in 
the composite atomicity model assuming a distributed weakly fair daemon. However, an ad hoc 
proof is necessary if one want to establish its self-stabilization under a distributed unfair daemon. 
Notice that the algorithm of Dolev et al and its bounded memory variant are used in the design 
of several algorithms written in this composite atomicity model, e.g., |23l[2l|. Moreover, several 
algorithms are based on similar principles, i.e., [251 I26j . Hence, a proof of its self-stabilization 
assuming a distributed unfair daemon is highly desirable. 

^As a matter of facts, |9] and [T0| are respectively cited 109 and 409 times in Google Scholar. 
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Contribution. In this paper, we study three silent self-stabilizing BFS spanning tree algorithms 
written in the composite atomicity model. The first algorithm, called Algo^, is the straightforward 
translation of the Dolev et afs algorithm |10] into the composite atomicity model. The second one, 
AlgOg(Z)), is a variant of Algo^^, where the process local memories are bounded. To that goal, 
the knowledge of some upper bound D on the network diameter is assumed. Finally, The third 
algorithm, noted Algo.^(j(Z)), is a generalization of the Huang and Chen’s algorithm [^, where the 
exact knowledge of n is replaced by the knowledge of some upper bound D on the network diameter 
(n.6., by definition, n is a particular upper bound on the diameter). 

The general purpose of this paper is twofold. First, we show the close relationship between 
these three algorithms. To see this, we propose a general and simple proof of self-stabilization for 
the three algorithms under the distributed unfair daemon. This proof implies that every executions 
of each of the three algorithms is finite in terms of steps. Moreover, notice that the proof shows in 
particular that the assumption on the exact knowledge of n in the initial algorithm of Huang and 
Chen was too strong. Second, the proof also validates the use of the Dolev et aFs algorithm and its 
bounded-memory variant in the composite atomicity model assuming any daemon (in particular, 
the unfair one). 

Second, we propose a complexity analysis the stabilization time of these three algorithms in both 
steps and rounds. Our results are both positive and negative. First, we show that the stabilization 
time of Algo^ and AlgOg(D) is optimal in rounds by showing that in both cases the worst case is 
exactly T> rounds. With few modifications our proof can be adapted for the read/write atomicity 
model, validating then the conjecture in m which claimed that the stabilization time the Dolev 
et aFs algorithm was asymptotically optimal in rounds. 

We then establish a lower bound in Q{D) rounds on the stabilization time of Algo.^^(D). Now, 
Algo^^(n) is actually the algorithm of Huang and Chen. Thus, the algorithm of Huang and Chen 
stabilizes in D(n) rounds. This result may be surprising as until now this algorithm was conjectured 
to stabilize in 0(T)) rounds. More precisely, this negative result is mainly due to the fact that two 
rules of the algorithm are not mutually exclusive, and when both rules are enabled at the same 
process p, the daemon may choose to activate any of them. Our lower bound is thus established 
when the daemon gives priority to one of the two rules {HCi). Hence, to circumvent this problem 
we proposed a straightforward variant, noted AlgOjr.^^(D), where we give priority to the other rule 
(HC 2 ). We then establish that in this latter case the stabilization time becomes exactly D + 1 
rounds in the worst case. 

Finally, we consider the stabilization time in steps. Our results are all negative. Indeed, we first 
show that the stabilization time in steps of Algo^ cannot be bounded by any function depending on 
topological parameters. We then exhibit a lower bound exponential in D (the actual diameter of the 
network) on the stabilization time in steps which holds for both AlgOg(D) and Algo.^^(D). Notice, 
by contrast, that the stabilization time of the solutions proposed in [22] and [l3| are O(A.n^) steps 
and 0(n®) steps, respectively. 

Roadmap. The rest of the paper is organized as follows. The next section is dedicated to the 
description of the computation model and definitions. The formal codes of the three algorithms 
are given in Section In Section we propose our general proof of self-stabilization assuming 
a distributed unfair daemon. In Section we analyze the stabilization time in rounds of the 
three solutions. We present an analysis of the stabilization time in steps of the three solutions in 
Section]^ Section]^ is dedicated to concluding remarks. 
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2 Preliminaries 


2.1 Distributed Systems 

We assume distributed systems of n > 0 interconnected processes. One process, called the root, is 
distinguished, the others are anonymous. The root of the system is simply denoted by R. Each 
process p can directly communicate with a subset J\fp of other processes, called its neighbors. We 
assume bidirectional communications, i.e., if g G Mp, then p G Mq. The topology of the system is 
a simple undirected connected graph G = {V, E), where V is the set of processes and E is the set 
of edges, each edge being an unordered pair of neighboring processes. \\p,q\\ denotes the distance 
(the length of the shortest path) from p to g in G. We denote by V the diameter of G, i.e., 
V = maxp^ggy \\p,q\\- 


2.2 Computational Model 

We consider the locally shared memory model with composite atomicity introduced by Dijkstra [T], 
where each process communicates with its neighbors using a finite set of locally shared variables, 
henceforth called simply variables. Each process can read its own variables and those of its neigh¬ 
bors, but can write only to its own variables. Each process operates according to its (local) program. 
A distributed algorithm A consists of one local program A{p) per process p. 

A{p) is given as a finite set of rules: {Labek : Guardi — )• Actioui}. Labels are only used to 
identify rules in the reasoning. The guard of a rule in A{p) is a Boolean expression involving the 
variables of p and its neighbors. The action part of a rule in A{p) updates some variables of p. 
The state of a process in A is defined by the values of its variables in A. A configuration of A is 
an instance of the states of every process in A. Cyi is the set of all possible configurations of A. 
(When there is no ambiguity, we omit the subscript .4.) A rule can be executed only if its guard 
evaluates to true, in this case, the rule is said to be enabled. A process is said to be enabled if at 
least one of its rules is enabled. We denote by Enabled{'^) the subset of processes that are enabled 
in configuration 7 . When the configuration is 7 and Enabled{’j) 7 ^ 0, a daemon selects a non-empty 
set X C Enabled{'y); then every process of X atomically executes one of its enabled rule, leading to 
a new configuration 7 ', and so on. The transition from 7 to is called a step (of 4.). The possible 
steps induce a binary relation over C^, denoted by 1 —(or, simply t—>■, when it is clear from the 
context). An execution of 4. is a maximal sequence of its configurations e = 7071 ... 7 *... such that 
7 j_i I—)• 7 j for all z > 0. The term “maximal” means that the execution is either infinite, or ends 
at a terminal configuration in which no rule of A is enabled at any process. We denote by (or, 
simply £, when it is clear from the context) the set of all possible executions of A. The set of all 
executions starting from a particular configuration 7 is denoted ^( 7 ). Similarly, £{S) is the set of 
execution whose the initial configuration belongs to 5 C C. 

As previously stated, each step from a configuration to another is driven by a daemon. In 
this paper we assume the daemon is distributed and unfair. “Distributed” means that while the 
configuration is not terminal, the daemon should select at least one enabled process, maybe more. 
“Unfair” means that there is no fairness constraint, i.e., the daemon might never select an enabled 
process unless it is the only enabled process. 

We say that a process p is neutralized during the step 7 * 1 —)■ 7 j+i if p is enabled at 7 * and 
not enabled at 7 i+i, but does not execute any rule between these two configurations. An enabled 
process is neutralized if at least one neighbor of p changes its state between 7 ^ and 7 ^+ 1 , and this 
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change makes the guards of all rules of p false. To evaluate time complexity, we use the notion of 
round. This notion captures the execution rate of the slowest process in any execution. The first 
round of an execution e, noted e', is the minimal prefix of e in which every process that is enabled 
in the initial configuration either executes an action or becomes neutralized. Let e" be the suffix 
of e starting from the last configuration of e'. The second round of e is the first round of e", and 
so forth. 

2.3 Self-Stabilization and Silence 

We are interesting in algorithms which converge from an arbitrary configuration to a configuration 
where output variables define a specific data structure, namely a BFS spanning tree. Hence, we 
define a specihcation as a predicate SP on C which is true if and only if the outputs define the 
expected data structure. 

Silent Self-stabilization is a particular form of self-stabilization defined by Dolev et al [8] as 
follows. A distributed algorithm A is silent self-stabilizing w.r.t. specification SP if following two 
conditions holds: 

Termination: all executions of A are finite; and 

Partial Correctness: all terminal configurations of A satisfy SP. 

In this context, the stabilization time is the maximum time (in steps or rounds) to reach a 
terminal configuration starting from any configuration. 

3 Three Self-Stabilizing BFS Constructions 

Below we give three self-stabilizing BFS constructions: Algo^, AlgOg(Z)), and Algo.^^(T))0 In all 
these variants, the local program of the R just consists in the following constant: dn = 0. 

Each non-root process p maintains two variables: dp and parp. The domain of parp is Mp, the 
set of p’s neighbors. The domain of dp differs depending on the version: 

• dp is an unbounded positive integer in the first version, Algo^^. 

• dp G [l-.T)] in the two other algorithms, AlgOg(Z)) and klgOy^Q{D). The correctness of both 
AlgOg(L)) and k\go^Q[D) will be established for any D >1). 

The three algorithms use the following three macros: 

• MinA{p) = min{(iq | q G Afp} 

• bestParent{p) is any neighbor q such that dq = MinA{p) 

• update{p): dp G- Min.d{p) -|- 1; parp G- bestParent{p) 

Moreover, the following two predicates are used in the algorithms: 

• dOk{p) = {dp = MinA{p) -\- 1) 

• parOk{p) = {dp = dpavp + 1) 

The two variables are maintained using the actions defined below. 

B, T-LC respectively stand for unbounded, bounded, and Huang-Chen. 


5 



3.1 Actions of Algo^^ 

The BFS algorithm in m is designed for the read/write atomicity model. The straightforward 
adaptation of this algorithm in the locally shared memory model is given below. 

Ui :: -^dOk{p) —)■ update{p) 

U 2 dOk{p) A ^parOk{p) -A pavp bestParent{p); 

3.2 Actions of AlgOg(Zl) 

The following algorithm is a variant of Algo^, where the domain of the d-variable is now bounded 
by the input parameter D. 


Bi : 

: Min.d{p) < D A -^dOk{p) 

-A update{p) 

B 2 : 

: Min_d{p) < D A dOk{p) A -^parOk{p) 

-A parp A- bestParent{p) 

53 : 

: Min_d{p) = D A {dp 7 ^ D) 

—y dp i — P) 


3.3 Actions of Algo.^^(Zl) 

Actions given below are essentially the same as those of the BFS algorithm given in [9]. Actually, 
they differ in two points from the version of [9]. 

• In [^, d-variables are defined in such way that d^ = 1 and dp > 2,'dp G "F \ {i?}. We 
have changed the domain definition of the d-variables for sake of uniformity. However, this 
difference on the domain definitions has no impact on the behavior of the algorithm. 

• Moreover, to be more general, we have replaced in the code the exact value n (the number of 
processes) by D. 

HC\ .. ~'p(iTOk(jj') A dpavp 'A D y dp i dpdp^ -t- 1 

HC 2 dparp > Min-d{p) -A update{p) 


Notice that HCi and HC 2 are not mutually exclusive, i.e., in some configurations, both rules 
can be enabled at the same process. For instance, in the initial configuration of Figure a (page 


12), rules HCi and HC 2 are enabled at process a. In this case, if a is selected by the daemon, the 


daemon also chooses which of the two rules is executed. 


4 Correctness 

In this section, we give a general proof which establishes the self-stabilization of the three algorithms 
under a distributed unfair daemon. The proof of correctness consists of the following two main 
steps: 

Partial correctness (Theorems and which means that if an execution terminates, then 
the output of the terminal configuration is correct. (In our context, the output of the terminal 
configuration define a BFS spanning tree rooted at R.) 

Termination (Theorem which means that every possible execution is finite in terms of steps. 
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4.1 Partial Correctness 

Below we establish the partial correctness of Algo^^, AlgOg(ll), and Algo-^^(ID) using three main 
steps: (1) we dehne a set of legitimate conhgurations (Dehnition Q , and show that (2) a BFS 
spanning tree is dehned in each legitimate conhguration (Theorem [y and (3) every terminal con- 
hguration of each algorithm is legitimate (Theorem]^, additionally, we show that every legitimate 
conhguration is terminal in any of the three algorithms (Theorem]^. 

4.1.1 Legitimate Configurations 

Definition 1 A configuration is legitimate if and only if for every process p, we have dp = ||p, -R|| 
and if p R, then dp = dparp + 1 • 

Let Try = {V, Et), where Et^ = {{p, q}^E\qfiR/\ pavq = p in 7 }. 

Theorem 1 is a BFS spanning tree in every legitimate configuration 7 . 

Proof. Let 7 be any legitimate conhguration. We hrst demonstrate that T.y is a spanning tree by 
showing the following two claims: 

Ty is acyclic: Assume, by contradiction, that Ty contains a cycle po, ■ ■ ■ ,Pk,Po- By dehnition, R is 
not involved into the cycle. Assume, without loss of generality, that for all i > 0, pavpy = pi-i 
et parpg = pk in 7 . From Dehnitionj^ in 7 we have dp. > dp._.^ and, by transitivity, > dp^. 
Now, as parpq = pk, we have dp^ > dp^, by Dehnitiona contradiction. 

\Et.,\ = n — 1: First, by dehnition we have \Ej'.^\ < n — 1. Now, if < n — 1, then there is at 
least one edge {p, such that parp = q and parq = p. This contradicts the fact that Ty is 
acyclic. Hence, \Et.^\ = n — 1. 

We now show that Ty is breadth-hrst. Let po = R,... ,p the unique path from 1? to p in the tree. By 
dehnition, for all i > 0, parp^ = Pi_i. By Dehnitionwe have dp. = dp._y + 1 and, by transitivity, 
dpy, = dpq + k. Moreover, dp^ = dji = 0. So, dp^, is the length k of the path from R to p^. Now, by 
Dehnition]^ dp^ is also equal to ||i?,pfc||. Hence, the length k of the path from R to pk is equal to 
the distance from R to pk in G. □ 

4.1.2 Legitimacy of Terminal Configurations 

Let D > T). Let TCiigo^y, 7~CAigog(D)) be the set of terminal conhgurations of 

klgoy, AlgOg(D), and Algo.^^(D), respectively. 

Lemma 1 Let 'y be a configuration o/TCAigo^- Let X he the largest distance value in 7 . ^ is a 
configuration o/TCAigog(x)- 

Proof. Every process p satishes dOk{p) AparOk{p) in 7 . So, the rule Bi and B 2 of TCAigog(x) are 
disabled at p in 7 . Moreover, by dehnition, dp < X and parOk{p) in 7 implies that dpar^, < X in 
7 . So, Min.d{p) < A in 7 and, consequently, H 3 of TCi^igo^(x) is disabled at p in 7 . □ 

Lemma 2 Let D > V and 'j be a configuration. If ^ be a terminal configuration of AlgOg(Z?), 
then 7 is a terminal configuration 0 /Algo.^^(D). 
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Proof. We establish this lemma by showing its contrapositive. Let 7 ' be a non-terminal conhgura- 
tion of Algo.^^(D). There is a process p such that {^parOk{p) A dparp < D) V {dpavp > Min-d{p)) 
holds in 7 '. 

Assume hrst that ^parOk{p) Adpavp < D holds in 7 '. Then, dparp < D implies that Min-d{p) < 

D holds. Thus either Bi or B 2 is enabled in 7 ' because ^parOk{p) holds. 

Assume then that dparp > Min.d{p). Then, as dparp < D (by dehnition), we have Min.d{p) < 

D. So, if ^dOk{p), then Bi is enabled in 7 '. Otherwise, we have dp = Min-d{p) + 1. So, 
dp / dparp + 1 and, consequently, B 2 is enabled in 7 '. 

Hence, every non-terminal conhguration of Algo.^^(Z?) is a non-terminal conhguration of AlgOg(Z)). 

□ 

From the two previous lemmas, we have: 

Corollary 1 TCAigo;, ^ 'rCAigog(i) C T'CAigo^cW • 

From the previous corollary, we know that it is sufficient to show that any conhguration of 
'7~CAigo^g(i) is legitimate to establish that any conhguration of TCAigo^, USx>'^CAigog(i), and 
U“D7'CAigo^^(i) are legitimate. 

Lemma 3 Let D >V. In any configuration of TCwe have dp < \\p, i?|| for every process 

p. 

Proof. Let 7 be any terminal conhguration of k\go.p^p,[D). Assume, by the contradiction, that 
there is a process p such that dp > ||p, R\\ in 7 . Without loss of generality, assume p is one of the 
closest processes from R such that dp > \\p, i?|| in 7 . By dehnition, \\p, i?|| < V, and p has at least a 
neighbor, q, such that \\q, i?|| = \\p, i?|| — 1 < V. By hypothesis, dq < ||g, R\\ = \\p, i?|| — 1 in 7 . So, 
we have Min_d{p) < \\p, i?|| — 1 < P < Z) in 7 . Then, by dehnition, dparp > Min.d{p) in 7 . Now, 
HC 2 is disabled at p in 7 . So, dparp = Min-d{p) in 7 . Consequently, dparp < \\p-, R\\ — 1 < D in 7 . 
Now, HCi is disabled at p in 7 . So, dp = dparp + 1 < \\p, Z?|| in 7 , a contradiction. □ 

Corollary 2 Let 7 6 e a configuration of TCwhere D >V. Every process p R satisfies 
dp = dparp + 1 and dparp = Min.d{p) in 7 . 

Proof. Let p Rhe process. By dehnition, dparp > Min.d{p) in 7 . HC 2 is disabled at p in 7 . So, 
dparp = Min-d{p) in 7 . p has a neighbor such that ||(?, R\\ <T> — 1. So, we have dq < P — 1 in 7 
(by Lemma and, consequently, Min.d{p) < D in 7 . So, dparp < D in j. As HCi is disabled at 
p in 7 , we have also dp = dparp + 1 - n 

Lemma 4 Let D > V. Let^ be a configuration ofTCi^igap^^{D)- dp = ||p, ZZ|| holds for every process 
p, in 7 . 


Proof. We have d^ = 0 (by dehnition) and dq = dpar^ + 1 for every process q R in j (corollary 
[^. So, similarly to the proof of Theorem we can establish that T.y is spanning tree and for every 
process p, dp is the length of the path in Tj from R to p. So, we have dp > \\p, iZ|| in 7 . Now, 
dp < \\p, Z?|| in 7 , by LemmaSo, we conclude that dp = \\p, Z2|| in 7 , for every process p. 

□ 


From Corollaries 


IE 


and Lemma 1^ we can deduce the following theorem; 


Theorem 2 Let D > B. Every terminal configuration o/Algo^, AlgOg(D), or is 7 is 

legitimate. 



4.1.3 Legitimate Configurations are Terminal 

Theorem 3 Let D > T*. Every legitimate configuration is a terminal configuration of Algo^, 
AlgOg(Zl), and Algo.^^{D), respectively. 

Proof. Let 7 be a legitimate configuration. First, for every process p, dp = \\p, i?|| < V. So, 7 is a 
possible configuration of Algo^, AlgOg(il), and Algo.^^(L)), respectively. 

Let p be a non-root process. We have Min-d{p) = min{(ig | q G Mp} = min{||g, i?|| | g G Mp} = 
Up, i?|| — 1 < D < L) in 7 . So, is disabled at every non-root process in 7 . 

Moreover, Min-d{p) -|- 1 = ||p, 1?|| = dp in 7 . So, Ui and Bi are disabled at every non-root 
process in 7 . 

By definition, parOk{p) holds in 7 . So, U 2 , B 2 , and HCi are disabled at non-root process in 7 . 
Finally, parOk{p) implies that dpavp = dp — 1 = ||p, — 1 = Min-d{p) in 7 . Hence, HC 2 is 

disabled at every non-root process in 7 . □ 

4.2 Termination 

In this subsection, we will establish that, under a distributed unfair daemon, all executions of 
Algo^, AlgOg(il), and AlgOy^Q{D) are finite. 

The lemma given below establish that we only need to prove that the number of d-variable 
updates is finite in any execution e of Algo^, AlgOg(L)), or AlgOy^Q{D) to establish that e is finite. 

Lemma 5 Let e = 70 ,.. . 7 i, 7 i+i, ... be any execution of AlgOy, AlgOg(L)), or A\gOp^(,{D) . If for 
every process p, dp is modified only a finite number of time along e, then e is finite. 

Proof. Assume that every process p, dp is modified only a finite number of time along e. Then, 
there exists i > 0 such that no d-variable is modified in the suffix P = 7i7i+i • • • of e. By definition 
of the three algorithms, only par-variables can be modified along eh So the rules Ui for Algo^, Bi 
and B 3 for AlgOg(L)), and HCi for A\gOp^(,{D) are not executed along e'. Now, by definition of 
the algorithms, in e', we have: 

• Once the rule modifying parp (Rule U 2 , B 2 , or HC 2 ) is disabled, it remains disabled forever by 
p, because the values of d-variables are constant (in particular, those ofp and its neighbors). 

• The rule modifying parp (Rule U 2 , B 2 , or HC 2 ) becomes disabled immediately after p’s 
execution. 

Consequently, each process takes at most one step along e'; we conclude that the execution e is 
finite. □ 

Notation 1 For every configuration 7 , for any integer k > 0, we denote by Set.dk{'y) the set of 
processes p such that dp = k in 7 . 

Remark 1 In every configuration 7 , 5et_do(7) = {-R}; o^nd 5et_d^(7) f) 5eCdfc(7) = 0 for every 
{)<i<k. V = Set.di{^). 

The following lemma establishes that for every execution e of Algo^, AlgOg(i7), or AlgOy^^^iD), 
there is a upper bound kb on the values taken in e by the d-variables of all processes. 
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Lemma 6 Let e = 70 ,.. . 7 j, 7 j+i, ... be any execution of klgoy, AlgOg(L)), or Algo-^^(Z)). 3/c6 > 
0 I Vj > 0 ,V^ > kb we have Set-di{'^j) = 0 . 

Proof. By definition, the lemma is established by letting kb = D if e is an execution of AlgOg(Z?) 
or Algo^c(-^)- 

Consider now the case where e is an execution of Algo^. VUB is the set of processes that have 
no upper bound on their distance value in e, formally, VUB = {p € V \ \/k > 0,3j > 0,3i > k \ p € 
Set^d^ijj)} 

Assume, by the contradiction, that VUB is not empty. The set V \ VUB is not empty, by 
Remark As the network is connected, there are two neighboring processes p and q such that 
p G VUB and q € V \ VUB. By definition, > 0 such that dq < x in all configurations of 
e. Consequently, Min.d{p) < x in all configurations of e. So, we have dp < max{x + l,y} in all 
configurations of e, where y be the initial value of dp (according to the rule Uf). Consequently, 
p ^ VUB, a contradiction. 

Hence, VUB is empty. Let ubp the upper bound on the distance values taken by the process p 
in e. The lemma holds for kb = maXpgy{M 6 p}. □ 

Below, we show that, for every k > 0, for every execution e of Algo^^, AlgOg(L)), or AlgOy^Q{D), 
if there is a suffix U of e where every d-variable whose value is less than k is constant, then there 
is a suffix e" of e' where no process switches its d-variable from any non-/c value to k. 

Lemma 7 Let e = 70 ,...7i,7i+i,... be an execution 0 /Algo^, AlgOg(D), or klgOq^Q{D). Let 
k > 0. If3ik I Vj > G [0../c — 1] we have Set.d^f^j) = Set_d^{'^i^), then 31 > i^ \ Mj > I we 
have Set-dk{'yj+i) U Set-dk{'yj). 

Proof. Let 7 ^ 1 —)■ ‘Jj+i be any step in the suffix of e starting in 7 ^^, where Set.dki'jj+i) ^ Set_dk{'yj). 
There is at least a process p ^ R such that p ^ Set-dki'jj) Ap G Set.dk{'yj+i). In jj, we have 
dp > k, as Set-di{'yj) = Set-di{'yj^i) G [0../c — 1] and p ^ Set-dki'jj). Moreover, p executes a 
rule in 7 ^ 1 —)• 7 j+i. In the following, we prove that p will no more change its d-variable in e after 
this step. 

• Consider first Algo^. We have Min_d{p) = k — lin jj. Moreover, by hypothesis, Min.d{p) = 
k — 1 forever from 74 (so, in particular from jj). So, p will no more change its distance value 
after 7 j+i. 

• Consider AlgOg(L)). If k = D, then dp should be greater than D in 7^-, a contradiction. So, 
k < D and dp > k in 7 ^. So p executes Bi in 7 ^ 1 —)• 7 j+i, and similarly to the previous case, 
7 j i-G 7 j+i is the only step in the suffix of e starting in 7 *^, where p sets dp to k. 

• Finally, consider klgOy^Q{D). We have to study the two following cases: 

— Assume that p executes HC 2 to set parp to q in 7 ^ 1 —)■ 7 ^+ 1 . By definition, Min_d{p) = 
A: — 1 = dg holds in 7 ^^ and all subsequent configurations. So, p is disabled forever from 
7i+i- 

— Assume that p executes HCi to set parp to q in 7 ^ 1 —)• Jj+i By definition, Min.d{p) < 
fc — 1 = dg < D in 7 jj, and all subsequent configurations. So, until p next action, we have 
parOkip) and dp = k. So, p next action is necessarily HC 2 to set dp to a value smaller 
than k, a contradiction. So, p cannot execute any rule in the suffix starting from 7 j+i. 
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Hence, in the suffix of e starting in there is at most n steps 7j i—>■ ^j+i where Set.dk{'jj+i) ^ 
Set-dkijj). □ 

Below, we show that, for every k > 0 , for every execution e of Algo^, AlgOg(L)), or Algo-^^(L)), 
if eventually every d-variable whose value is less than k becomes constant, then eventually every 
fi-variable whose value is k becomes constant. 

Lemma 8 Let e = 70,... 7i,7i+i,... he an execution 0/Algo^, AlgOg(D), or klgo^Q{D). Let 
k > 0. If 3 ik I Vj > ik,y£ G [0../c — 1] we have Set-d^{'^j) = Set_d^{'yi^), then | Mj > I we 

have Set-dk{'yj+i) = Set^dki'yj). 

Proof. By lemma there exists a suffix e' of e starting in 'jx, such that Vj > x, we have 
Set.dki'jj+i) C Set.dki'jj). During e', there is at most \Set.dk{'yi^)\ steps jj 1—)> 'Jj+i where 
Set^dki'yj+i) / Set^dki'jj). □ 

From Remark Lemmas and we can deduce the following corollary. 

Corollary 3 For every process p, dp can he modified only a finite number of time in e. 

By Lemma Corollary]^ follows: 

Theorem 4 Under a distributed unfair daemon, all executions o/Algo^, AlgOg(D), and Algo.^^(D) 
are finite. 

5 Stabilization Time in Rounds 

In this section, we study the stabilization time in rounds of the three algorithms presented in 
Section Throughout this section we will use the notion of attractor defined below. 

Let 7I be a distributed algorithm. Let Ci and C2 be two subsets of C, the set of all possible 
configurations of A. C2 is an attractor for Ci (under Vl) if the following conditions hold: 

Convergence: Ve = 70,71,... G <S(Ci), > 0 | 7* G C2. 

Closure: Ve = 70,71, •.. G <£’(C2),Vz > 0 | 7^ G C2. 

The following predicate is useful to establish a sequence of attractors. 

Pred-Correct_node{p,i) = (||i?,p|| <i^ {dp = ||R,p|| = dparp + 1)) 

For every f > 0 , Att{i) is the set of configurations, where every process p fi R satisfies 
Pred-Correctmode{p, i). 

In any configuration of Att{'D), every process p fi R satisfies {dp = ||R, p|| = dparp+ 1 ), moreover 
dr = 0 , by definition. So, all configurations of Att{'D) are legitimate. Furthermore, every legitimate 
configuration is terminal in all of the three algorithms (Theorem]^. Hence, the stabilization time 
of any of the three algorithms is bounded by the maximum number of rounds it requires to reach 
any configuration of Att{'D) starting from any arbitrary configuration. 


II 


5.1 Lower Bound in Q{D) Rounds for Algo^^(Zl) 

We first show that the stabilization time in rounds of Algo-^^(il) actually depends on the size of 
the domain of the d-variables. Hence, we can conclude that Algo.^^(n), i.e., the algorithm proposed 
in [9], stabilizes in H(n) rounds, where n is the number of processes. 

Let k > 1. We now exhibit a possible execution of Algo.^^(2A:) which stabilizes in /c + 1 rounds 
in the 3-nodes graph given in Figure (its diameter is 2). Notice that this execution requires 2k 
steps. 


R a b 

e ^ 

0 2 1 

Initial configuration 


R 


0 4 

Configuration at the end of the first round 

R 


a 


0 2k 2k-1 

Configuration at the end of the k — 1th round 


R 


0 1 2A; - 1 

Configuration at the end of the fcth round 

R 


0 1 2 
Configuration at the end of the k + 1th round 


Figure 1: Execution of klgo^^{2k) which converges in A: -|- 1 rounds 


• At the beginning of the zth round with i G [1,/c — 1], processes a and b are enabled. In the 
first step of these rounds, b executes HCi. During the second step (the last step of these 
rounds) the node a executes HCi. 

• At the beginning of the A:th round, only process a is enabled. During the only step of this 
round, a executes HC 2 and gets its terminal state. 

• At the beginning of the k + 1th round, only process b is enabled. During the only step of this 
round, process b executes and gets its terminal state. 


This example can be generalized to any number of processes n > 3. Just construct a network G 
of n processes by adding n — 3 processes to the network given in Figure those n — 3 processes 
being only neighbors of R. Since the state of R is constant, these n — 3 processes have no impact 
on the behavior of a and b. Hence, the previous execution is a possible execution prefix in G which 
contains Q{D) rounds. 
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Hence, the stabilization time of klgo^Q{D) is Q{D) rounds. 

The lower bound on the stabilization time is mainly due to the fact that rules HCi and HC2 
are not mutually exclusive. Hence, when both are enabled at the same process p, the daemon 
may choose to activate any of them. Our lower bound is then established when the daemon makes 
priority on HCi. 

In the following subsection, we show that this lower bound can be easily circumvented to obtain 
the stabilization time in Q(T>) rounds. 

5.2 Fast Implementation of Algo^(j(Zl)) 

5.2.1 Algorithm AlgOjry^^^D) 

Below, we propose a variant of klgo^Q{D) where we have modified HCi into FHCi, so that FHCi 
and HC2 are now mutually exclusive. The modification of HCi into FHCi gives it priority on 
HC2- In the following, this variant will be denoted by Algo and called fast implementation 
of Algo^ciD). 

FHCi -^parOk{p) A dparp < F) A dparp = Min.d{p) -A dp ^ dparp + 1 
HC2 ■■ dparp > MinH{p) -A update{p) 

The lemma given below show the close relationship between and AlgOg(D). 

Lemma 9 Ifj eA is a step of Algocontaining execution of rules HC 2 only, then 7 1— )■ 7' 
is a possible step o/AlgOg(il). 

Proof. Let 7 1—)■ 7' be any step of Algojry^Q{D) containing execution of rules HC 2 only. Consider 
any process p that moves during 7 1—)■ 7'. So, p performs HC2 during 7 1—)■ 7' and we have 
Min.d{p) < dparp < D in 

If -^dOk{p) is true in 7, then Bi is enabled at p in 7. Now, the action part of Bi and HC2 are 
identical. 

Conversely, assume that dOk{p) is true in 7. During A ^ l'■: P does not modify dp, however 
parp is set to bestParent{p). Now, ^parOk{p) is true in 7, so B2 is enabled while Bi is not. In 
this case, the action part of B2 has the same effect as the action part of HC2. 

Hence, in any case, 7 i—)- 7' is a possible step of AlgOg(D). □ 

5.2.2 Upper Bound on Stabilization Time in Ronnds of AlgOjr^(j(D) 

The Pred-UBH{p,i) and Pred-Correct-d{p, i) predicate defined below are used to establish a se¬ 
quence of "D -|- 1 attractors under AlgOjr-^(j(D) (with D > F) ending in the set of the terminal 
configurations. 

PredJJB_d{p, i) = (||i?,p|| > i => (dp > i V (dp = i A { 3 q G Afp \ dq < i + 1 )))) 

PredJJBH{p, i) means that if a process p is at distance larger than i from R, then either dp 
should be also larger than f, or dp should be equal to i and a neighbor of p should have its distance 
to R smaller than or equal to f -|- 1. 

Pred-CorrectH{p,i) = (||d?,p|| < i ^ dp = ||ii,p||) 
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Pred-Correct-d{p, i) means that if a process p is at least at distance i from R, then its distance 
value should be correct, ie., dp is equal to its distance to the R. 

Below, we define some useful subsets of configurations. 

• Let AttJJB{i) be the set of configurations, where every process p ^ R satisfies PredJJB_d{p, i). 

• Let Att_dist{i) be the set of configurations, where every process p satisfies Pred-Correct_d{p, i). 

• Let Att-HC{i) = Att-dist{i) n Att-UB{i). 

Notice that Att-P[C{ 0 ) is the set of all possible configurations. 

Observation 1 Let p he an process such that \\p, ii|| > i + 1 . So, we have i + 2 < P. Let 7 be 
a configuration of Att-HC{i). By definition of Att.HC{i), we have dp > i and dq > i for every 
q^Afp in every execution from 7. Consequently, Min-d{p) > i along any execution from 7. 

Lemma 10 Assume that Att_HC{i) is an attractor under Algo with D > P andO <i<P. 

Let 'y be a configuration of Att-HC{i). Let 7 1—)> 7' 6e a possible step where process p moves. 
PredJJB_d{p,i + 1 ) holds in 7'. 

Proof. Let p be a process such that \\p, i?|| > i + 1 (the other case is trivial). We have dp > i + 1 
in 7' according to observation!^ 

If dp > i + 1 in 7', then PredJJB_d{p,i + 1 ) holds. Otherwise, we have dp = i + 1 in 7'. Let 
q G Mp such that dq = Min_d{p) in 7. We have dq = i va. 7. By definition of Att_HC{i), we have 
Min.d{p) < i + 2 in 7'. Hence, PredJJB_d{p,i + 1 ) holds in 7'. □ 


Lemma 11 If Att-HC{i) is an attractor under Algojrqi(<{D) with D > P and < i < P, then 
AttJJB{i + 1) is an attractor under AlgOjr-^^(Zl) from Att-HC{i) which is reached within at most 
one round from Att-HC{i). 


Proof. 


Closure. Let 7 i—?- 7' be a possible step from any configuration 7 of Att-HC{i). We show that for 
every process p R, PredJJB_d{p,i + 1 ) holds in 7, then PredJJB_d{p,i + 1 ) holds in 
7'. Assume ||p, R\\ > i + 1 (the other case is trivial). Assume that p does not move during 
the step; otherwise PredJJB_d{p,i + 1 ) holds in 7' according to Lemma 
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If dp > i + 1 in 

7, PredJJB_d{p,i + 1 ) holds in 7'. Assume now that in 7, dp = i + 1 and p has a neighbor 
q such that dq < i + 2. While dp = i + 1, Min-d{q) < i + 1, so dq < i + 2. Hence, we can 
conclude that PredJJB_d{p,i + 1 ) still holds in 7'. 


Convergence. We now show that for every process p R, PredJJB_d{p,i + 1) becomes true 
within at most one round from any configuration 7 of Att-HC{i). Assume \\p, i?|| > i + 1 (the 
other case is trivial). 


• If dp > i + 1 in 7, then PredJJB_d{p, i + 1 ) holds. 

• If dp = i in 7, then p is enabled while dp = i because Min-d{p) > i forever from 
7 (Observation!^. So, p moves during the first round from 7, and we are done, by 
Lemma [101 
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• Assume that dp = i + 1 in 7. 

— If p moves during the hrst round from 7, then PredJJB_d{p, i + 1 ) holds after the 
step, by Lemma 

— Assume that p does not move during the first round from 7. 

* If a neighbor of p, q, moves during a step of the round, then after this step 
PredJJB_d{p, z + 1 ) holds because dq < i + 2 . 

* Assume that neither p nor its neighbors move during the round. So the value 
of dq is less than or equal to i + 2 in 7, for all q G Mp. Indeed, if some neighbor 
of p, q, satisfies > i + 2 in 7, then q stay enabled along the round from 7, 
because of the state of p. This contradicts the dehnition of round. Hence, the 
value of dq is less than or equal to i + 2 in 7, for all q G Mp, and consequently 
PredJJB_d{p,i + 1 ) holds in 7. 

□ 


Lemma 12 If Att-HC{i) is an attractor under AlgOjr-^c(Il) with D > P and 0 < i < P, then 
Att_dist{i + 1) is an attractor under AlgOjr-^^(Zl) from Att-HC{i) which is reached within at most 
one round from any configuration of Att_HC{i). 

Proof. Let pi+i be a process at distance i + 1 of R. pi+i has at least a neighbor pi such that 
\\pi, i?|| = i. Let 7 G Att_HC(i). By dehnition of Att_HC{i) and as Att_HC{i) is an attractor, we 
can deduce that dp^ = i and Mq G AAp-^j, dq > i forever from 7. So, from 7 Mzn_d(pj+i) = i forever. 

Consequently, if dp.^^ / z + 1 in 7, then pj+i is enabled to execute FHCi or HC2 to set dp._^j 
to z + 1. 

Moreover, if dp.^^ = z + 1 in 7, then pj+i cannot modify dp^_^j in any step from 7. 

Hence, Att-dist{i + 1 ) is an attractor under AlgOj-.^^(L)) from Att-HC{i) which is reached 
within at most one round from any conhguration of Att-HC{i). □ 

From the two previous lemmas, we can deduce the following corollary. 

Corollary 4 If Att-HC{i) is an attractor under AlgOj'.^^(Z)) with D > P and 0 < i < P, then 
Att_HC{i + 1 ) is an attractor under Algofrom Att.HC{i) which is reached within at most 
one round from any configuration of Att_IIC{i). 


The previous corollary establishes that after at most P rounds, the distance value in every 
process is accurate forever. We now show one additional is necessary to hx the par-variables. 

Lemma 13 Att(P) is an attractor under AlgOjr-^^(Il) (with D > P) from Att-HC{P) which is 
reached within at most one round from any configuration of Att_HC{P). 


Proof. In any conhguration of Att-HC(P), dp = Min-d{p) + 1 holds forever for every process p. 
So, the distance value of any process stays unchanged along any execution of AlgOj-.^^(Z)) from a 
conhguration of AttMC{P). 

Let 7 be a conhguration of Att-HCiP) where dparp / Min-d{p). The rule HC2 is enabled at p 
until p executes it. After the execution of this rule, we have dp = dpar^ + 1 - As no process changes 
its distance value in Att-HC{P), p is become disabled forever. 

Hence, we conclude that Att{P) is an attractor which is reached within at most one round from 
Att.HC{P). □ 


From Corollary and Lemma 13 , we have the following theorem: 
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Theorem 5 For every D > 1 ), the stabilization time 0/AlgOjr-^c(-D) is at most V + I rounds. 

5 . 2.3 Lower Bound on Stabilization Time in Rounds of AlgOjr^^(D) 

Below, we show that the upper bound given in the previous theorem is exact when 0 = 1 ): VP > 2 , 
there exists an execution of Algo^(j(P) in a graph of diameter P that stabilizing in P + 1 rounds. 
We consider any graph G = (V, E) of P + 2 nodes of diameter P > 1 , where 

• V = {pq = R,... ,PD+i}, and 

• E = {{pi,pi+i}\i e [ 0 ..P]} U {{pTD+i.pv-i}}. 

We consider a synchronous execution [i.e. an execution where the distributed unfair daemon 
activates all enabled processes at each step) which starts from the following initial configuration: 

• dR = 0, 

• Vz G [ 1 ..P - 2 ],parp- = pj_i A dp- = P, 

• parp.^-1 = Pv+i A dpj,_i = P, 

• parpj, = pD+i A dpj, = P, and 

• parp.^_^_^ = pT,_i A dp-j, = P - 1 . 

An example of initial configuration is given in Figure Notice that in a synchronous execution, 
every round lasts one step. 

• At each round i G [ 1 ..P — 2 ], pi executes FHCi to change dp^ to i. 

• At the P — 1th round, pv-i executes HC2 to set dpj,_^ to P — 1 and parp.p_.^ to pv-2- 

• At the Pth round, pv+i executes FHCi to set dpj,_^j to P. 

• At the P + 1th round, p-n executes HC2 to set parp.^ to pv-i- 
Hence, we can conclude with the theorem below. 

Theorem 6 The worst case stabilization time 0/AlgOjr-^^ (P) is P + 1 rounds. 

5.3 Algorithms Algo^ and AlgOg(Zi)) 

We now establish that the stabilization time of both Algo^ and AlgOg(P) is exactly P rounds in 
the worst case. 
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Figure 2 : Initial configuration of a synchronous execution of Algo ("D) which stabilizes in "D + 1 
rounds 


5.3.1 Upper bound on the Stabilization Time in Rounds for both Algo^ and AlgOg(Zl) 

We first establish that the stabilization time of both Algo^ and AlgOg(Zl) is at most T) rounds in 
the worst case. To that goal, we use the predicate Pred-SUB_d{p,i) defined below: 

Pred-SUB_d{p,i) = (||i?,p|| > i ^ dp > i) 

Pred.suB_d{p,i) means that dp must be larger than i if the process p is at a distance larger 
than i from R. 

We will also use the following sets: 

• Let Att.SUB{i) be the set of configurations where every process p satisfies Pred.SUB.d{p, i)). 

• Let Att.B{i) = Att{i) n Att.SUB{i). 

Notice that all configurations belong to Att-SUB{ 0 ). 

Lemma 14 If Att.B{i) is an attractor under AlgOy (resp. AlgOg(L)) where D > V) with 0 <i < 
V, then Att{i + 1 ) is an attractor under Algo^ (resp. AlgOg(U)^ from Att.B{i) which is reached 
within at most one round from any configuration of Att.B{i). 

Proof. Let pi+i be a process at distance i + 1 oi R. By definition, pj+i has at least one neighbor 
Pi at distance i of R. As Att.B{i) is an attractor, from any configuration of Att.B{i), the three 
following conditions hold forever: (i) dp^ = i, (ii) Min.d{pi+i) = i < D, and {Hi) for every process 
q, dq = i^ \\q, i?!! = i. 

Let 7 I—)■ 7' be a possible step such that 7 is a configuration of Att.B{i). We first show that for 
every process p, if Pred.correct.node{pi^i, i + 1 ) holds in 7, then Pred.correct.node{pi^i, i + 1 ) 
holds in 7'. From 7, = L so dparp.^^ is no more modified by (Hi). In 7, = i + 1 and 

is no more modified by {ii). Hence, dp^+i = dparp. ^ + 1 and p is disabled forever from 7. 
Hence, Pred.correct.node{pi+i, i + 1 ) still holds in 7'. 

We now show that for every process p, Pred-Correct-node{pi+i,i + 1 ) becomes true within at 
most one round from any configuration 7 of Att.B{i). Assume that dp^_^^ / i + 1 or dparp.7 ^ i 
in 7. Then, pj+i is enabled in Algo^ (resp. AlgOg(U)) until it executes an action, by (i) and 
{ii). Moreover, after pj+i move, we have dp^^.^ = i + 1 = dparp. + !> by (i) and (ii). Hence, 
Pred.correct.node{pi^i, i + 1 ) becomes true within at most one round from 7. □ 
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Lemma 15 If Att-B{i) is an attractor under Algo^ (resp. AlgOg(Il) where D >T>) with 0 < i < 
V, then Att-SUB{i + 1 ) is an attractor under hlgo^ (resp. AlgOg(Il)j from Att-B{i) which is 
reached within at most one round from any eonfiguration of Att_B{i). 

Proof. Let p be a process such that \\p, i?|| > i + 1 . In this case, we have i + 2 <!) < D. 

In any configuration of Att-B{i), we have dp > i and dq> i for any neighbor g of p by definition 
of Att_B{i). So, starting from any configuration 7 of Att-B{i), Min-d{p) > i holds forever. 

Hence, if dp > f + 1 in 7, then dp > i + 1 forever from 7, which implies that if Att_SUB{i + 1 ) 
holds in 7, then Att-SUB{i + 1) holds forever from 7. 

Assume now that dp = z + 1 in 7. Then, dp = i + 1 < D and, as Min-d{p) > i holds forever 
from 7, p is continuously enabled from 7 until it executes either Ui in Algo^^, or Bj,j G { 1 , 2 } in 
AlgOg(Zl). After p move, dp > z + 1 . Hence, Att-SUB{i + 1 ) holds within at most one round from 
7. □ 

Corollary 5 If Att_B{i) is an attractor under Algo^ (resp. 0 /AlgOg(Il) where D > T>) with 
0 < i < V, then Att_B{i + 1 ) is an attraetor under klgoy (resp. AlgOg(Zl)} from Att_B{i) which 
is reached within at most one round from any configuration of Att-B{i). 

From the previous corollary and owing the fact that Att_B{T>) = Att{T>), we can deduce the 
following theorem: 

Theorem 7 The stabilization time 0 /Algo^ and AlgOg(ZI) (for every D >T>) is at most T> rounds. 

5.3.2 Lower Bound on the Stabilization Time in Rounds for both Algo^ and AlgOg(T)) 

Below, we show that the upper bound is exact for both Algo^ and AlgOg(II) when D >T>. 

Consider first AlgOj_^. Let G = {V, E) be any line graph of diameter V, i.e., V = {po = 
R,pi,... ,px>} and E = {{pi,pi^i} \ i G [ 0 ..P — 1 ]}. Consider the initial configuration where 
dpp = 0 and Vz G [l-.H], dp. = X, where X > V. (Par-variables have arbitrary values). Consider 
a synchronous execution starting from that initial configuration. Then, at each round z, with 
z G [ 1 ..P], Pi executes Ui to definitely set dp. to i and parp. to pi-i. Moreover, Vj G [z + 1 ..P], Pj 
increments dp- by Ui. Hence, after T> rounds the system is in a terminal configuration. 

Consider now AlgOg(P)) with any value D >T>. Consider the same graph as for AlgOjr-^^j (P). 
However, we consider now a synchronous execution starting from any configuration where: 


• dfi = 0, 

• Vz G [ 1 ..P + 1 ], dp^ = D, 

• parpj, = pv+i, and 


• Parp^+i =pv. 

An example of initial configuration is given in Figure The synchronous execution starting from 
that configuration then works as follows: 

• In round z, with i G [ 1 ..V — 1 ], only process pi moves. It executes rule Pi to set dp. to z and 
parp. to pi-i. 
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Figure 3: Initial configuration of a synchronous execution of AlgOg(D) which stabilizes in T) rounds 


• In round T>, only pD and pv+i move. Two cases are possibles. Either D > D and they both 
execute Bi to set dp^, (resp. to V and pavp^ (resp. parp^^^) to pv-i- Or, D = V and 

they both execute B2 to set parp^ and parp^^^ to pv-i- 

Hence, we can conclude with the theorem below. 

Theorem 8 The worst case stabilization time of klgo^ and AlgOg(Z)) (with D > 1 )) is V rounds. 


6 Stabilization Time in Steps 

In this section, we propose a step complexity analysis of the three algorithms presented in Section]^ 

6.1 A General Bound 

The theorem below exhibits a trivial upper bound on the stabilization time in steps of every self- 
stabilizing algorithm working under an unfair daemon. 

Theorem 9 Let A be any self-stabilizing algorithm under an unfair daemon]^ the stabilization 
time of A is less than or equal to flpev ^ steps, where Sp is the set of possible states of p, 

for every process p. 

Proof. First, the number of possible configurations of A is llpeV" \^p\- Let e be any execution 
of A. A being self-stabilizing, e contain a maximal prefix of finite size e' = 7i,7j_|-i ... where its 
specihcation is not achieved. Let P' such that e = e'e'b 

Assume, by the contradiction, that 3 /c, t such that i <k < I and 7^ = 7^. Then, (7fc+i,..., 
is an infinite execution of A under the unfair daemon that never stabilized. So, A is not self- 
stabilizing under an unfair daemon, a contradiction. 

Hence, all configurations of e' are distinct. Moreover, \e"\ > 1 and e' and e" have no common 
configuration. Hence, e' contains at most OpeV \^p\ configurations, and so at most flpev \^p\ 
steps. □ 

The previous theorem is useless when considering algorithms where at least one variable as an 
infinite domain, e.g., Algo^. Now, for AlgOg(Zl) and Algo.^^(il), the theorem claims that their 
respective stabilization times are less than or equal to {n — 1 )^'^ steps. This upper bound may 
appear to be overestimated at the first glance. However, we will see in the next subsections that 
those algorithms are exponential in steps in the worst case. 

^The daemon can be central or distributed. 
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Figure 4 : Possible initial Configuration of the line of 5 nodes 


6.2 Algorithm Algo^ 


Here we consider the unbounded version given in Subsection 3.1 The following theorem shows 


that the step complexity of Algo^ cannot be bounded by any function depending on topological 
parameters, e.g., n, N, V, or D... 


Theorem 10 Let f be any function mapping graphs to integers. There exists a graph G and an 
execution e of Algo^ in G such that e stabilizes in more than f{G) steps. 


(The following proof is illustrated with Figure]^) 

Proof. Consider a line graph G of 5 nodes, where R is an extremity, i.e., G = {R,Pi,P2,P3,P4} 
and E = {{i?,pi}} U {{pi,pi+i},i G [ 1 -- 3 ]}. Let X > f{G) + 1 . Assume an initial configuration, 
where = dp^ = X and dp^ = dp^ = 1 . (The initial values of par variables are arbitrary and, by 
definition, dn = 0 .) Initially, all processes, except R, are enabled. Assume that p2 moves, then in 
the next configuration, dp^ takes value 2 and all processes, except R and p2, are enabled. Assume 
that p3 moves, then in the next configuration, dp^ takes value 3 and all processes, except R and ps, 
are enabled. By alternating activations of p2 and p^ the system reaches in A > f{G) + 1 steps a 
configuration where dn = 0 , dp^ = dp^ = X, and dp^ = dpg = X + 1 . □ 


6.3 Algorithm Algo^^(Zl) 

In this subsection, we establish that the stabilization times in steps of both Algo.^^(II) and 
AlgOg(ZI) are exponential in the worst case. The lowed bound is based on a family of graphs 
called Gk- For every fc > 0 , the graph Qf, contains 4 fc + 3 processes and has a diameter of 2 A: + 3 . 

Definition 2 (Graph Gi) Let Gi = iVi^Ei) be the undirected graph, where 

• Vi = {f.0,e.l, f.l,h.0,g.l,h.l,R} and 

• El = {{fi, h.O}, {h.O, /.O}, {/.O, e.I}, {e.I, /.I}, {/.I, A.I}, {g.l, e.l}}. 

We now consider three classes of configurations for the graph Gi. In all consider configurations: 

• the distance value of g.l, h.l, and h.O are z — 1 , 

• de.i = z if and only if par^.i = g.l, and 

• dj.j = z if and only if parji = h.i, for i G [0,1]. 

The three classes of configurations are defined as follows where x > 1 and z > 1 : 
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Figure 5: Examples of configurations of Qi 


• In the configurations of conf2i{x, z), the distance value of e.l and /.I is 2 ;, and the distance 
value of /.O is x. 

• In the configurations of conf3i{x, z), the distance value of e.l is x, and the distance value of 
/.I and /.O is z. 

• In the configurations of con/4i(a;, z), the distance value of e.l and /.O is z, and the distance 
value of /.I is X. 

Except otherwise mentioned, all other variables have arbitrary values. Notice that we have conf2{z, z) = 
conf3i{z, z) = conf4:i{z, z). An illustrative example of these three types of configurations of Qi is 
given in Eigurej^ 

Observation 2 Let v,z,D be three integers such that 1 > v < z < D. 

• From any configuration of conf3i{v, z), a configuration of conf2i{v + l,z) is reachable in a 
single step 0 /Algo.^^(E)), where e.l and /.O execute HC 2 - 

• From a configuration of conf 2i{v, z), a configuration of conf 3i{v+ 1, z) is reached in a single 
step of klgo^^Q^D), where e.l and f.O execute HC 2 - 

Notation 2 Let v and z be two integers such that 1 < v < z and z > 1. Let nbSteps{v, z, 1) be 
the maximal number of steps of klgo^(^{D) (with D > z) to reach a configuration ofconf3i{z,z) 
from a configuration of conf 3i{v, z). 

Observation 3 Let v and z be two integers such that 1 < v < z and z > 1. We have nbSteps{v + 

2, 2 ; + 2 , 1) = nbSteps{v, 2 ;, 1). 

Lemma 16 In Qi, for every 1 < v < z — 2, there is a execution ei(fc) 0 /Algo.^^(Zl) (with D > z), 
starting in a configuration of conf 3i{v, z) and where only rules HC 2 are executed, which reaches a 
configuration of conf 3i{v + 2,z) in at least 2 steps. 


Proof. Immediate from Observation!^ 

Corollary 6 

• // 1 < u < 2 ; and z > 1 then nbSteps{v, 2 ; + 2,1) > 2 : — u. 


□ 
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• Let k > 1. In Qi, there is a execution of Algo-^^(D), with D > 2k + 3, which starts in 
a configuration of conf 3i{l, 2k + 3), contains only executions of rules HC 2 , and reaches a 
configuration of conf 3i {2k + 3,2k + 3) in at least 2k + 2 steps. 

• nbSteps{l,5,l) = 4. 

The following definition generalizes Definition 
Definition 3 (Graph ^i+i) Let Gi+i = iVi+i, EiJ^fi) he the undirected graph, where 

• Vi+i = 14 U {e.i + 1, f.i + l,g.i + 1, h.i + 1} and 

• Ei+i = EiUE{_^_.^^, where = {{f.i, e.i+ 1 }, {^.i+l, e.i+ 1 }, {e.i+ 1 , /.i+ 1 }, {f.i+1, h.i+1}}. 

We mainly consider four classes of configurations for any graph Qi+i. In all consider configura¬ 
tions: 


• the distance value of g.i + 1 and h.i + 1 is z — 1, 

• for every j £ [ 0 , i + 1 ], de.j = 2 ; if and only if pare.j = g.j, and 

• for every j G [ 0 , i + 1 ], df,j = z if and only if parfj = h.j. 

The four classes of configurations are then defined as follows where x > 1 and z > 1: 

• In the configurations of confli^i{x,z), the configuration of the subgraph Qi belongs to 

conf3i{x, z), the distance value of e.i + 1 is a: and the distance value of f.i + 1 is z. 

• In the configurations of conf2i+i{x,z), the configuration of the subgraph Qi belongs to 

conf4i{x, z), the distance value of e.i + 1 and f.i -|- 1 is 2 ;. 

• In the configurations of conf3i+i{x,z), the configuration of the subgraph Qi belongs to 

conf3i{z, z), the distance value of e.i + 1 is x, and the distance value of f.i -t- 1 is 2 ;. 

• In the configurations of con/4j+i(x, 2 ;), the configuration of the subgraph Qi belongs to 

conf3i{z, z), the distance value of e.i + 1 is 2 ;, and the distance value of f.i + 1 is x. 

Except otherwise mentioned, all other variables have arbitrary values. Notice that we have con/lj+i( 2 ;, z) 
conf2i^i{z, z) and conf3i+i{z,z) = conf4i^i{z,z). Some illustrative examples are given in Fig¬ 
ures El 

Observation 4 Let v,z,D he three integers such that 1 < v < z < D. 

• From any configuration of conf3iJ,-i{v,z), a configuration ofconf2i^i{v + 1 , 2 ;) is reachable 
in a single step 0 /Algo.^^(D), where e.i + 1 and f.i execute HC 2 . 

• From a configuration of conf2ij^i{v, z), a configuration ofconfli^i{v + l,z) is reached in a 
single step of AlgOy^Q{D), where e.i -|- 1, e.i, and f.i execute HC 2 . 

The notation below generalizes Notation 
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f.O e.l f.l e.2 f-2 e.3 f.3 

configuration conf3-^{v, z) 
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R 



Figure 6 : Some configurations of 


Notation 3 Let v and z he two integers such that v < z. Let i > 1. Let nbSteps{v, z,i) be the 
maximal number of steps o/Algo^^(F)) (with D > z) to reach a configuration of conf3i{z, z) from 
a configuration of conf3i{v, z) in the graph Qj with j > i. 

Observation 5 Let v and z be two integers such that 1 < v < z and 1 < z. We have nbSteps{v + 
2 , z + 2 , i) = nbSteps{v, z, i) and nbSteps{v, z,i + 1) > nbSteps{v, z, i). 

Lemma 17 Let z and D be two integers such that z < D. Let i > 1. In the graph Qj+i with 
j > i, for every I < v < z — 2, there is an execution o/Algo-^^(Il) starting from a configuration of 
conf3i+i{v,z), where only rules HC 2 are executed, which reaches a configuration of conf3i+i{v + 
2, z) in at least nbSteps{v + 2, z,i) + 2 steps. 

Proof. From a configuration of conf3i+i{v, z), a configuration of con/lj+i(u + 2, z) is reached in 
two steps of Algo^^(Zl) where only rules HC 2 are executed, by Observation|^ From a configuration 
of confli+i{v + 2 , z), a configuration of con/3j+i(u + 2 , z) is reached in at least nbSteps{v + 2 , z, i) 
steps of Algo^^(Zl) where processes of the subgraph Qi only execute rules HC 2 (according to the 
definition of nbSteps{v, z, i)). □ 

From Observation and Lemma we can deduce the following corollary. 

Corollary 7 

• Let 1 <v < z and I < z. nbSteps{v, z + 2 ,i + l )>2 + nbSteps{v, z, i) + nbSteps{v, z,i + 1). 
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• Let j > k. In the graph Qj, there is a execution ek{j) 0 /Algo^^(Z)), with D >2j + 3, which 
starts in a configuration of conf3k{l,2j + 3), contains only executions of rules HC 2 , and 
reaches a configuration of conf3k{2j + 3, 2j + 3). 

Notation 4 nbTotal{2k + 3) = Y2^^^nbSteps{l,2k + 3,£). 

Definition 4 let k > 1. Let e^ be the execution 0 /Algo-^^(Z?), with D > 2k + 3, in the graph Qk 
defined as follows: e^ is the concatenation of ei{k).. .ek{k). 

By definition, contains at least nbTotal{2k + 3) steps, moreover those steps are only made 
of rules HCfi's executions. 

Theorem 11 For all k > 1, nbTotal{2k + 3) = 2.nbTotal{2k + 1) + 2k + nbSteps{3, 2k + 3,k). 

Proof. nbTotal{2k + 3) = nbSteps{l, 2k + 3,i). 

We have: 

• nbSteps{l, 2k + 3,1) = 2 + nbSteps{l, 2k + 1,1), by Corollary]^ 

• nbSteps{l, 2k + 3,k) = 2 + nbSteps{l, 2k + 1, k — 1) + nbSteps{3, 2k + 3, k), by Corollary 
and Observation m 

• nbSteps{l, 2k + 3,i) = 2 + nbSteps{l, 2k + I,! — 1) + nbSteps{l, 2k + 1, i) for i € [2, A: — 1], 
by Corollary!^ 

So, we can conclude that nbTotal{2k+3) = ^^“j^(2.re65'teps(l, 2A:+1, tj)+2k+nbSteps{3, 2k-\-3, k). 

□ 

The following corollary establishes a lower bound on the number of steps of which is expo- 

■P-l 

nential on the graph diameter: 2 2 . 

Corollary 8 For all k>l, nbTotal{2k + 3) > 2^~^.nbSteps{l,I),l) > 2^^^. 

We now propose a tighter bound on nbTotal{2k + 3). 

Lemma 18 For all k > 1, nbSteps{3, 2k + 3,k) > 2.(2^ — 1). 

Proof. By induction. 

Base Case: Let A: = 1. We have nbSteps{3, 5,1) > 2 = 2.(2^ — 1), by Corollary 
Induction Hypothesis: Assume that nbSteps{3, 2k + 3,k) > 2 .( 2 ^ — 1 ). 

Induction Step: By Corollary we have: 

nbSteps{3, 2k + 5, k + 1) > 2 + nbSteps{3, 2k -|- 3, A:) -|- nbSteps{3, 2k + 3,k + 1) 

By Observation!^ we have: 

nbSteps{3, 2k + 5,k + l) >2 + 2.nbSteps{3, 2k + 3,k) >2 + 4.(2^ - 1) = 2 .( 2 ^+^ - 1 ) 
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□ 


Lemma 19 For all k > 1, nbTotal{2k + 3) > {2k + 2)(2^ — 1). 


Proof. By induction. 

Base Case: Let k = 1. nbTotal{5) = nbSteps{l,5, 1) = 4, by Corollary]^ 
Induction Hypothesis: Assume that nbTotal{2k + 3) > {2k + 2 )( 2 ^ — 1) for k > 1. 

Induction Step: 


• nbTotal{2k + 5) = 2.nbTotal{2k + 3) + 2 fe + 2 + nbSteps{3, 2k + 5, k), 

• nbTotal{2k + 5) > 2.{2k + 2 )( 2 ^ — 1) + 2 /c + 2 + nbSteps{3,2k + 5, 
hypothesis. 


by Theorem 11 


k), by induction 


• nbTotal{2k + 5) > 2.(2/c + 2)(2^ - 1) + 2/c + 2 + 2.(2^ 

• nbTotal{2k + 5) > (2/c + 2)(2^+^ - 2) + 2.2^+^ + 2/c. 

• nbTotal{2k + 5) > {2k + 4)2*^+^ - 2.(2/c + 2) + 2k. 


1), by Lemma 
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So, we conclude that nbTotal{2k + 5) > {2k + 4)2^+^ — (2/c + 4). 


□ 

Theorem 12 Let n > 7. Let k the maximum integer such that n = 4/c + 3 + y with y > 0. For 
every D > 2k + 3, there is an execution of klgOy^(^{D) which stabilizes in at least (2/c + 2)(2^ — 1) 
steps containing only executions of rules HC 2 in an n-node graph of diameter at most 2/c + 4. 


Proof. Let Qk = {Vk,Ek). Let = {Vk U vi,... ,Vy,Ek U {{vi, R},i G [l-.y]})- Since Gk has 
diameter 2/c + 3, has at most diameter 2/c + 4. Since Gk contains 4/c + 3 nodes, G'k contains n 
nodes. Finally, nodes vi,... ,Vy are only neighbors of R whose state is constant. So, vi,... ,Vy have 
no impact on the behavior of nodes of Gk- Hence, we can apply Lemma 19 and we are done. □ 


Corollary 9 For every n-node graph G, AlgOy^Q{n), i.e., the algorithm proposed in stabilizes 
in Gl{2^) steps, where V is the diameter of G. 


6.4 Algorithm AlgOg(Zl) 

Theorem |12| exhibits an execution exponential in steps where only rules HG 2 are executed. So, 
this execution is also an execution of AlgOjr-^c(Il) {i.e., the fast implementation of Algo.^^(T))). 
Moreover, this is also a definition of AlgOg(Zl), by Lemma |^. Hence, we can conclude with the 
following theorem: 

Theorem 13 Let n > 7. Let k the maximum integer such that n = 4/c + 3 + y with y > 0. For 
every D > 2k + 3, there is an execution of Algo^{D) (resp. AlgOjr-^^(D)J which stabilizes in at 
least (2/c + 2)(2^ — 1) steps in an n-node graph of diameter at most 2/c + 4. 
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7 Conclusion and Perspective 


In this paper, we revisited two fundamental results of the self-stabilizing literature mm- More 
precisely, we proposed three silent self-stabilizing BFS spanning tree algorithms working in the 
composite atomicity model inspired from the solutions proposed in [9l [TO]: Algorithms Algo^, 
AlgOg(Z)), and Algo^^(ii)). We then presented a deep study of these algorithms. Our results are 
related to both correctness and complexity. 

Concerning the correctness part, we proposed in particular a new, simple, and general proof 
scheme to show the convergence of silent algorithms under the distributed unfair daemon. We 
believe that our approach, based on process partitioning, is versatile enough to be applied in the 
convergence proof of many other silent algorithms. 

Concerning the complexity part, our analysis notably shows that the Huang and Chen’s al¬ 
gorithm [9] stabilizes in H(n) rounds (where n is the size of the network), while it confirms that 
the stabilization time in rounds of the Dolev et a/’s algorithm m is optimal (exactly T> rounds in 
the worst case). Finally, our analysis reveals that the stabilization time in steps of Algo^ cannot 
be bounded, while the stabilization time of both AlgOg(L)) and Algo.^^(L)) can be exponential in 
"D, the diameter of the network. Our results must be put in perspective with the complexities of 
the silent BFS construction proposed in which stabilizes in 0{'D‘^) rounds and 0{n^) steps, 
respectively. This suggests the existence of a trade-off between the complexity in rounds and steps 
for the silent construction of a BFS tree. This conjecture would have to be investigated in future 
works. 
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